Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- REGISTRY QUERY
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
REGISTRY QUERY
hi
i try to query a registry key but Nothing is displayed
index="" sourcetype=WinRegistry key_path="\REGISTRY\USER\.\Software\WOW6432Node\Master\ConfigurationCountry\.*
could you bring me help please?
IN INPUT/
[WinRegMon://hkcu_run1]
disabled = 0
hive = \REGISTRY\USER\.\Software\WOW6432Node\Master\ConfigurationCountry\.
proc = .*
type = set|create|delete|rename
index = windows
thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
it works until :
index="" sourcetype="winregistry" key_path="\registry\user
but after un have an error message:
⚠ Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk. See search.log for more information.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Could you please share the search.log information
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
BUTut i got results Index="windows" sourcetype=WinRegistry
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
After getting above data can you select the key_path from selected fields? Also can you try to find out Event Code 4657 ?
This doc may help:
https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/5a3187b4419202f0fb8b2dd1/151319544...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hI loglognathan Nothing is also displayed....
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Could you please try this query
index="windows" sourcetype=WinRegistry disabled = 0 type=set OR type=create OR type=delete OR type=rename key_path="\REGISTRY\USER.\Software\WOW6432Node\Master\ConfigurationCountry.*
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hi
now i use this request but Nothing is displayed.
index="" sourcetype=WinRegistry disabled = 0 type=set OR type=create OR type=delete OR type=rename key_path="\REGISTRY\USER.\Software\WOW6432Node\Airbus\Master\ConfigurationCountry."
an idea please?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Could you please try only this query
ndex="windows" sourcetype=WinRegistry disabled = 0 type=set OR type=create OR type=delete OR type=rename
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Could you please provide the SS of Index="windows" sourcetype=WinRegistry
or please provide the result sample
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
